MAL-2022-6705 Malicious code in twitch-sandstorm (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fcd573519ac08041f5b10977c8d09bca8339255384d62fe4eb54eaee6efc6069 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Sandstorm Server-Side Request Forgery Vulnerability Vulnerability

Sandstorm is a personal cloud platform. The platform features file storage, application management, task and project management, and more. A server-side request forgery vulnerability exists in the install application process in versions prior to Sandstorm build 0.203. A remote attacker can exploi...

Sandstorm Security Bypass Vulnerability

Sandstorm is a personal cloud platform. The platform features file storage, application management, task and project management, and more. A security vulnerability exists in versions prior to Sandstorm build 0.203, which stems from the program failing to adequately validate email addresses. A...

Sandstorm Arbitrary File Read Vulnerability

Sandstorm is a personal cloud platform. The platform features file storage, application management, task and project management, and more. A security vulnerability exists in versions prior to Sandstorm build 0.203, which stems from the failure of the 'findFilesToZip' function to filter newline n...

Sandstorm Supervisor Denial of Service Vulnerability

Sandstorm is a personal cloud platform. The platform features file storage, application management, task and project management, etc. Supervisor is one of the management components. A security vulnerability exists in Supervisor in Sandstorm that stems from the program's failure to limit the total...

CVE-2017-6200

Sandstorm before build 0.203 allows remote attackers to read any specified file under /etc or /run via the sandbox backup function. The root cause is that the findFilesToZip function doesn't filter Line Feed \n characters in a directory name...

Directory traversal

Sandstorm before build 0.203 allows remote attackers to read any specified file under /etc or /run via the sandbox backup function. The root cause is that the findFilesToZip function doesn't filter Line Feed \n characters in a directory name...

CVE-2017-6198

The Supervisor in Sandstorm doesn't set and enforce the resource limits of a process. This allows remote attackers to cause a denial of service by launching a fork bomb in the sandbox, or by using a large amount of disk space...

CVE-2017-6200

Sandstorm before build 0.203 allows remote attackers to read any specified file under /etc or /run via the sandbox backup function. The root cause is that the findFilesToZip function doesn't filter Line Feed \n characters in a directory name...

CVE-2017-6199

A remote attacker could bypass the Sandstorm organization restriction before build 0.203 via a comma in an email-address field...

Design/Logic Flaw

The Supervisor in Sandstorm doesn't set and enforce the resource limits of a process. This allows remote attackers to cause a denial of service by launching a fork bomb in the sandbox, or by using a large amount of disk space...

Server side request forgery (ssrf)

A Server Side Request Forgery vulnerability exists in the install app process in Sandstorm before build 0.203. A remote attacker may exploit this issue by providing a URL. It could bypass access control such as firewalls that prevent the attackers from accessing the URLs directly...

CVE-2017-6199

A remote attacker could bypass the Sandstorm organization restriction before build 0.203 via a comma in an email-address field...

CVE-2017-6198

The Supervisor in Sandstorm doesn't set and enforce the resource limits of a process. This allows remote attackers to cause a denial of service by launching a fork bomb in the sandbox, or by using a large amount of disk space...

CVE-2017-6198

The CVE-2017-6198 issue concerns Sandstorm’s Supervis or component: the resource limits of a process are not set or enforced, enabling a remote attacker to cause a denial of service by launching a fork bomb in the sandbox or consuming excessive disk space. This vulnerability is described across m...

CVE-2017-6199

A remote attacker could bypass the Sandstorm organization restriction before build 0.203 via a comma in an email-address field...

CVE-2017-6198

The Supervisor in Sandstorm doesn't set and enforce the resource limits of a process. This allows remote attackers to cause a denial of service by launching a fork bomb in the sandbox, or by using a large amount of disk space...

CVE-2017-6200

Sandstorm before build 0.203 allows remote attackers to read any specified file under /etc or /run via the sandbox backup function. The root cause is that the findFilesToZip function doesn't filter Line Feed \n characters in a directory name...

CVE-2017-6200

Technical details about CVE-2017-6200 are not publicly provided in the supplied documents. Monitor for updates.

CVE-2017-6201

CVE-2017-6201 corresponds to a Sandstorm SSRF vulnerability in the install application process prior to build 0.203. A remote attacker can supply a URL to bypass access controls (e.g., firewalls) that would normally restrict URL access. The issue stems from insufficient validation in the install ...